Name: Win95.Apo Category: Viruses Description: Details Win95.Apop It is not a dangerous memory resident parasitic virus. It replicates under Win9x systems only. The virus stays in Windows memory as a VxD driver, hooks file operations (IFS), and then infects PE EXE files that are being opened. While infecting a file the virus writes itself to "caves" in file body, if there are such ones. The infection method looks similar to the "Win95.CIH" virus: the virus body is split to blocks that are stored at the end of PE sections, if there are "caves" of enough size. Depending on month and its internal counters the worm ejects CD drive.